governance: add trial period for new web-infra members

[ovflowd]

Summary

This PR introduces a trial period policy for new members of the @nodejs/web-infra team, as proposed in #8.

New Web Infra Team members will undergo a 3-month trial period with reduced permissions across infrastructure services before being granted full access. This ensures that new members can demonstrate competence and trustworthiness while minimizing risk to critical infrastructure.

Changes

GOVERNANCE.md

Added a new "Trial Period for New Members" subsection under the Web Infra Team section, defining:

• A 3-month trial period with limited access
• Specific reduced permission levels during the trial (read-only Cloudflare, Viewer on Vercel, read-only Sentry/Crowdin/Statuspage, no 1Password)
• Mentorship expectations for existing team members
• Criteria for concluding the trial (consensus-based assessment by existing members)
• Flexibility to shorten or extend the trial period

PERMISSIONS.md

Added a new "Trial Period Permissions for New Web Infra Members" section with a comparison table showing trial vs. full access levels for each external service. Clarifies that GitHub repository permissions are unaffected by the trial.

onboarding/web-infra.md

Restructured the onboarding checklist into two phases:

• Phase 1: Trial Period Access — initial limited permissions granted immediately upon acceptance
• Phase 2: Full Access (Post-Trial) — elevated permissions granted after successful completion of the trial period

Motivation

As noted in #8, giving new members immediate full access to critical infrastructure services carries unnecessary risk. A trial period:

• Allows new members to build familiarity with processes and systems
• Gives existing members time to assess competence and trustworthiness
• Reduces potential impact of accidental misconfigurations
• Aligns with the emphasis on competence and trust already present in the governance model

Fixes #8

[Copilot]

Pull request overview

Adds a formal “trial period” onboarding policy for new @nodejs/web-infra members, documenting reduced initial access to external infrastructure services before granting full privileges.

Changes:

• Add a “Trial Period for New Members” policy section to Web Infra governance.
• Add a trial-vs-full external service permissions comparison table.
• Restructure the Web Infra onboarding checklist into Phase 1 (trial) and Phase 2 (post-trial full access).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

File	Description
GOVERNANCE.md	Defines the 3-month trial period policy, expectations, and assessment criteria for Web Infra.
PERMISSIONS.md	Documents trial vs post-trial access levels per external service and clarifies GitHub permissions are unchanged.
onboarding/web-infra.md	Splits onboarding steps into trial-period access tasks and post-trial elevation tasks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Terminology is inconsistent across docs: GOVERNANCE.md/onboarding use “Read-only”, while this table uses “Read”. Aligning on a single term (ideally the exact role name used by each provider) would reduce confusion when granting access.

Suggested change

	| **[Cloudflare][]** | Read | Read | Read-only access is sufficient for day-to-day; elevated access may be granted on a case-by-case basis post-trial. |
	| **[Cloudflare][]** | Read-only | Read-only | Read-only access is sufficient for day-to-day; elevated access may be granted on a case-by-case basis post-trial. |

[Copilot]

The onboarding checklist describes trial-period access grants, but it doesn’t include any step for the Cloudflare read-only access mentioned in the PR description and in GOVERNANCE.md. Either add an explicit onboarding task (e.g., request/add the nominee in Cloudflare via the owning team) or clearly state in this phase that Cloudflare access is handled separately/optional due to @nodejs/build ownership.

[Copilot]

Inconsistent formatting/capitalization for “Nominee”: elsewhere in the onboarding docs the term is consistently bolded as Nominee, but these sub-tasks use plain “Nominee”. Aligning this keeps the checklist consistent and easier to scan.

[Copilot]

The trial-period table includes Cloudflare “Read” access, but the onboarding checklist doesn’t currently mention how/when Cloudflare access is granted (and the main External Services table notes it’s controlled by @nodejs/build). Consider clarifying in this section whether Cloudflare access is expected during the trial, and if so, how it’s coordinated with the owning team.

Suggested change

	| **[Cloudflare][]** | Read | Read | Read-only access is sufficient for day-to-day; elevated access may be granted on a case-by-case basis post-trial. |
	| **[Crowdin][]** | Read | Admin | Read access to review translations; admin access after trial. |
	| **[Sentry][]** | Read | Admin | Read access to view error reports and logs; admin access after trial. |
	| **[Vercel][]** | Viewer | Developer | Viewer access allows reviewing deployments and checking logs; Developer access after trial. |
	> [!NOTE]
	> GitHub repository permissions are **not** affected by the trial period. New members receive the same repository-level access as all @nodejs/web-infra members from day one.
	| **[Cloudflare][]** | Read | Read | Read-only access is sufficient for day-to-day; during the trial, access requests are coordinated by @nodejs/web-infra with @nodejs/build, who own the Cloudflare account. Elevated access may be granted on a case-by-case basis post-trial. |
	| **[Crowdin][]** | Read | Admin | Read access to review translations; admin access after trial. |
	| **[Sentry][]** | Read | Admin | Read access to view error reports and logs; admin access after trial. |
	| **[Vercel][]** | Viewer | Developer | Viewer access allows reviewing deployments and checking logs; Developer access after trial. |
	> [!NOTE]
	> GitHub repository permissions are **not** affected by the trial period. New members receive the same repository-level access as all @nodejs/web-infra members from day one.
	> Access to external services owned by other teams (for example **[Cloudflare][]**, which is owned by @nodejs/build) is requested on your behalf by an existing @nodejs/web-infra member as part of onboarding.

[Copilot]

The trial-period guidance suggests sharing 1Password-stored credentials “on a case-by-case basis”. Credential sharing reduces accountability/auditability and can violate provider ToS. Consider rephrasing to recommend that an existing member performs the needed action, or that temporary/least-privilege individual access is granted for a specific task instead of sharing credentials.

Suggested change

	- **1Password**: Access is not granted during the trial period; credentials may be shared on a case-by-case basis by an existing member for specific tasks
	- **1Password**: Direct access is not granted during the trial period. For tasks requiring secrets or credentials, an existing member should either perform the required action or, where appropriate, grant temporary, least-privilege individual access (for example, via a shared vault or per-service role) instead of sharing their own credentials.

[avivkeller]

Suggested change

	Upon acceptance, new members of the Web Infra Team enter a **trial period of 3 months** with limited access to infrastructure services. The purpose of this trial period is to ensure new members can demonstrate competence and trustworthiness in managing critical infrastructure before being granted elevated privileges.
	Upon acceptance, new members of the Web Infra Team enter a **trial period of 3 months (90 days)** with limited access to infrastructure services. The purpose of this trial period is to ensure new members can demonstrate competence and trustworthiness in managing critical infrastructure before being granted elevated privileges.

[MattIPv4]

There is no read-only capability for status page

[MattIPv4]

Suggested change

- [ ] Grant the **Nominee** _Read-only_ access to the Node.js Status Page.

[MattIPv4]

Suggested change

	- [ ] Elevate the **Nominee** to _App Admin_ access on the Node.js Status Page.
	- [ ] Grant the **Nominee** _App Admin_ access to the Node.js Status Page.

[MattIPv4]

Suggested change

	- **Sentry, Crowdin, Atlassian Statuspage**: Read-only or limited access
	- **Sentry, Crowdin**: Read-only or limited access

[MattIPv4]

Suggested change

	| **[Atlassian Statuspage][]** | Read | App Admin | Public status page is accessible to everyone; management access is granted after trial. |
	| **[Atlassian Statuspage][]** | - | App Admin | Public status page is accessible to everyone; management access is granted after trial. |